Insights Into Risk Management: Spring 2012

Insights

Spring 2012 vol. 9, no. 1

into Risk Management

Risk: The Hazards of Social Networking in Healthcare – by Suzanne Duni, JD, RN, BSN

Social networking is a significant part of life in the 21st century. Facebook now has 700 million members worldwide, which is more than twice the population of the United States. In March 2011, Twitter announced it was averaging 200 million tweets per day. Although online social networking can be a powerful tool for organizations, and a convenient and enjoyable way to communicate and stay connected with friends and family, social media outlets present a myriad of legal and professional hazards for medical professionals who are not cautious in how, what and where they post information.

Breach of Patient Confidentiality There is a significant and costly potential consequence to online networking that is presented when providers intentionally or unintentionally post patient information. Providers have an ethical and legal obligation to protect patient privacy and confidentiality in accordance with state and federal law, and according to the Lifespan Social Media Policy, “may not publish any content that is related to a Lifespan affiliate patient.”

Patients, through the Office for Civil Rights in Washington, D.C., may bring claims related to the HIPAA Privacy and Security Act, if they believe their privacy has been breached. If proven, the provider and organization are subject to significant fines and penalties, including loss of federal funding to the provider or organization. Patients may also bring civil claims against providers and organizations related to breach of privacy and/or confidentiality when providers post information related to the patient’s protected health information, even where the provider believes they have sufficiently de-identified the patient’s identity. It is important to note: postings on social media sites create a permanent electronic record that is typically discoverable in a lawsuit, especially when publicly available or when shared with an undefined group of viewers.

Dept. of Risk Management 167 Point Street Suite 170 Providence, RI 02903 T: (401) 444-8273 F: (401) 444-8963

Employment Liability Beyond the risk of breaching a patient’s privacy, is the threat to a provider’s employment status, as well as their professional licensure with the state, when postings cross the line. To illustrate this point, consider this case of a “Facebook Firing.”

Two nurses from a Wisconsin hospital independently photographed a patient’s x-ray with their personal cell phone cameras, and one nurse posted it on her Facebook profile. The hospital employing the nurse became aware of the posting and immediately terminated both nurses, citing their actions were in clear violation of federal privacy protections under HIPAA. The nurses faced action from the state licensing board in addition to termination from their employment.

In a study in the September 23/30, 2009 Journal of the American Medical Association, researchers found that 60% of U.S. medical schools surveyed reported incidents of students posting unprofessional content online. 13% of the 78 medical schools participating in the survey found postings that violated patient confidentiality, 52% found postings containing profanity, 48% of the postings contained discriminatory language and 39% found depictions of intoxication. In most cases where students displayed inappropriate online conduct, a warning was issued or nothing was done. In a few cases, however, medical students with inappropriate online conduct suffered consequences, including suspension and dismissal. continued on page 2

inside…

Page 1 .... @ Risk: The Hazards of Social Networking in Healthcare Page 3 .... Meet the Lifespan Department of Risk Management Staff Page 4 ... FOCUS on Nursing: A Case Study

2

Risk

(continued) Continued from page 1

When it comes to blogging and participation on personal or professional chat boards, employees are subject to discipline and termination when posting their own ideas and opinions that may be construed by the viewing public, to be those of the provider’s organization. According to the Lifespan Social Media Policy, providers are encouraged to disclose their connection to Lifespan and their role within the organization when discussing Lifespan affiliates’ business interests or healthcare operations online. If a provider’s connection to Lifespan is apparent, the provider is encouraged to make clear that they are speaking on their own behalf with a statement such as, “the views expressed on this site [blog, website, social networking site] are my own and do not reflect the views of my employer.”

Personal/Professional Reputation Providers who participate in social networking through media outlets like Facebook, Twitter and professional accounts like LinkedIn, must be familiar with the potential reputational risks involved with use of these sites. Personal information and photos posted by providers may not only be accessible to family and friends, but also to patients, professional colleagues and future employers. Consider the reputational damage to the provider or organization that could result from the following post: “Exhausted – could hardly keep my eyes open today…can everyone just go to a different ER tonight?” Seemingly benign when read by a sympathetic friend or family member, this post takes on a whole different meaning when viewed by an employer, future patient or (shudder) a personal injury attorney at the other end of a malpractice lawsuit.

Additional Risks Other important risks exist as well. Social media outlets are a proven source of entry for hackers, who can ultimately cause a paralyzing security breach in the corporate network. Unintended copyright infringement can occur when posting or forwarding articles and other forms of intellectual property without the original author’s permission. And, as mentioned above, social media presents an almost unlimited opportunity for discovery of information in a lawsuit that before now, was obtainable only through a legal process. As social media evolves, it has become apparent that established legal principles and precedents have not kept up with the dynamic and borderless pathways of communication online networking provides.

Guidance from the AMA In 2010, the American Medical Association published their policy on use of social media that illustrated measures providers should take to mitigate or avoid risks while using any form of social media. Significant guidance is provided in the policy as follows: 1. Refrain from posting identifiable patient information online.

2. Monitor the physician’s Internet presence for accuracy and set privacy settings to safeguard personal information.

3. Understand that physician’s online actions and content may negatively affect their reputations, may have consequences on their medical careers, and may undermine public trust in the physician, or the entire medical profession.

Guidance from Lifespan For more information on appropriate use of Social Media, please see the following policies: 1. MC-1: Lifespan Corporation & Affiliates Employee Social Media Policy 2. MC-2: Guidelines for Physicians Who Use Facebook And Other Social Networks 3. CCPM-11: Confidentiality of Patient Information 4. IS-204: Internet Appropriate Use

2012 Risk Management Grant Program : 10 Years and Going Strong!

Did you know? Now in its tenth cycle, the Risk Management Grant Program received over 25 preliminary proposals seeking funding for projects related to loss prevention, patient safety and claims reduction. Invitations for full proposal submission will be sent to applicants in June, and Risk Management Grant awards will be announced in October, 2012.

For more information, see our grant website at: http://www.lifespan.org/risk/grant

3

Meet the Lifespan Department of Risk Management Staff Who Are We?

What Do We Do?

Like all of you, our Lifespan colleagues, we are a dedicated group of individuals who are passionate about what we do. For us, that is to identify, evaluate, control and reduce risk across the entire organization - and then some!

The Department of Risk Management is comprised of two distinct areas - Clinical Risk Management, which is a department of Lifespan Corporate Services - and Lifespan Risk Services, Inc. (LRS), which is wholly owned by Lifespan.

LRS, an independent insurance/claims administrator, was created to provide administrative services for Lifespan’s self-insured professional and general liability indemnity program, R.I. Sound Enterprises Insurance Co., LTD, or RISE. Though separate, Clinical Risk and LRS overlap on certain matters and occasionally collaborate, sharing ideas as appropriate to ensure the best service for our customers.

First and foremost, the experienced Claims staff is here to advise, support and guide you through the process of a claim or lawsuit. We coordinate all required legal services, and when indicated, carry out an investigation, taking steps to preserve information and evidence.

Where appropriate in the management of a claim, and always in a lawsuit, we assign an attorney to you who is knowledgeable and skilled in handling medical malpractice cases. Barring unusual circumstances, all covered defendants and witnesses in one case will be represented by the same attorney. This unification is an important strategy, leading to a carefully coordinated defense among all defendants.

Together with your attorney, we will meet with you during the litigation process to gather information and provide feedback and status updates. This includes preparing you Who Are Our Customers? for deposition or trial testimony, ensuring that you know You – the physicians and staff of the Lifespan facilities. what to expect.

And also like you, we share the common goal of ensuring We will collaborate with you regarding trial and settlethe delivery of safe care to the patients treated throughout ment decisions; however, LRS retains the right to settle any the Lifespan network. claims that it concludes should be settled subject to the authorization schedule established by RISE and Lifespan.

What Services Do We Provide?

In addition to claims-related matters, we also assist Clinical Risk Management has its own distinct area of with requests from the Rhode Island Board of Medical Licenresponsibility, and that of course is to manage risk through- sure and Discipline, the Rhode Island Nurse Registration and out the organization. LRS is divided into three components: Nursing Education Board, other professional healthcareBusiness Operations and Underwriting, Claims, and Loss Pre- related boards, and third party payors related to concerns vention. Beginning with this issue of Insights and continuing about patient care. Please contact LRS for help should the into the next several, we will describe each area and introneed arise. duce you to the staff in each, beginning with Claims.

Meet The Claims Staff

What Should Be Reported To Claims? When?

Prompt reporting of potential and actual claims leads to more effective claims management and a stronger defense.

The following are the kinds of issues that should be reported as soon as possible by calling Lifespan Risk Services (LRS) at (401) 444-8273:

♦ Any untoward medical incident or unexpected outcome that could result in a claim ♦ An unusual request for information or medical records by the patient or an attorney (Requests pertaining to workers compensation matters or automobile accidents are generally not considered unusual.)

LRS Claims Staff: (left to right) Robin Morra, Litigation Support ♦ A threat of legal action or demand for compensation Specialist; Joe Melino, Director; Sue Freaney, Senior Claims Analyst/Quality Coordinator; W. Patrick Freaney, Claims Analyst; ♦ A complaint about care provided where injuries are Patricia Harmon, Claims Analyst; ; Sharon Malloy, Claims Procesclaimed, whether factual or not sor; Deborah Maloney, Insurance/Customer Service Coordinator ♦ The service of formal lawsuit papers ♦ A request from your patient to speak with his/her attorney Stay tuned for the next issue of Insights in which we introduce you to the staff of Clinical Risk Management

4

FOCUS on Nursing - A Case Study The purpose of this section is to share summaries of closed cases that have occurred in the New England area and represent real life issues that provide proactive risk management educational opportunities. The cases used may come from Lifespan affiliates, or other institutions or practices, or may be composites of several cases with very similar fact patterns. We present these cases because we believe they have some relevance to situations that you may encounter.

CHAIN OF COMMAND ISSUE:

What is a nurse’s duty when s/he believes an inappropriate treatment plan has been implemented by a physician?

FACTS: ♦ A 19 year old motorcyclist was admitted to the Emergency Department after his involvement in a collision. The RN staff examined his left leg and foot over an extended period of time and extensively documented the patient’s complaints of pain and numbness. They were unable to detect a pulse in the patient’s lower leg and foot by portable Doppler Ultrasound, and did not immediately discuss the findings with the attending physician. ♦ The ED physician stated he was able to detect a pulse in the patient’s left leg and foot. Although x-rays noted fragments in the patient’s knee joint, the physician diagnosed a “severe knee sprain,” and the patient was discharged with instructions to see an orthopedic several days later. The RN staff disagreed with the physician, however, contrary to hospital policy, did not notify the supervisor of their opinion. ♦ The following morning the patient returned for further examination because of increased pain. At that time, a fracture, dislocation and a laceration of the popliteal artery were diagnosed. After extensive surgery, the patient sustained significant functional impairment to his left leg, and brought suit against the hospital, physician and nurses for medical negligence.

FINDINGS: ♦ The policy of the hospital involved stated that when a nurse “believed that appropriate care was not being administered by a physician,” the nurse was to report the situation to a supervisor, who would then discuss it with the MD. If still unresolved, the matter was to be referred up the chain of command for further evaluation. ♦ The nurses were aware that several tests indicated circulatory compromise and that the x-rays were incompatible with the MD’s diagnosis of “sprain.” They were also aware, or should have been aware, that the patient’s injury could result in permanent functional impairment without prompt medical intervention. By policy, they were required to report the situation to the supervisor who would have initiated the chain of command for further evaluation. ♦

The nurses had a DUTY to report conduct that clearly placed the patient’s health in imminent jeopardy.

SUMMARY: ♦ Whether or not a policy is available for guidance, a nurse who believes that a physician has mistreated or misdiagnosed a patient’s condition should first discuss the matter with the physician, and if the physician is not sufficiently responsive, the nurse has a DUTY to initiate the chain of command procedures to protect the patient.

Insights is published by Lifespan’s Department of Risk Management. Submissions and ideas are welcome and may be submitted to Suzanne Duni @ sduni@lifespan.org or Deborah Randall @ drandall1@lifespan, or by fax to 401-444-8963.